Microsoft Defender APIInstall

Summary

List security alerts using Microsoft Defender's API, optionally expanding evidence details and applying OData query operators for filtering, pagination, and limiting results.

Inputs

• Authentication (required) — Set authentication method, currently only OAuth2 is supported.
• Expand Evidence Details — Choose whether to expand evidence details in each alert's response.
• OData Operators — Apply OData operators to filter, limit (top), and offset (skip) the alerts returned. Filter supports fields such as ID, name, description, cvssV3, publishedOn, severity, and updatedOn.

Output shape

a list of alert objects retrieved from Microsoft Defender's API

The result is paginated and can be controlled via OData operators. By default, returns up to 10 alerts starting from the first. Evidence details are expanded if the corresponding option is enabled. Ensure OAuth2 credentials are configured for authentication.

Examples

Example 1: Retrieve the 5 most recent high severity alerts with expanded evidence details.

Set the 'Expand Evidence Details' to true, use OData Filter to specify severity as high, and set Top to 5 to limit results.

Links

• n8n community nodes installation guide